docs: add SPEC-REVIEW.md (MTC spec under-specification review)

Inverse of the literature review: catalogues where the MTC core draft,
the tiled-log profile, and the C2SP dependencies are unclear, ambiguous,
or divergence-prone, with severity and suggested resolutions. The two
highest-severity defects (single-pass entry_hash missing the 0x00 leaf
prefix; tlog-tiles Ed25519 MUST vs ML-DSA-44-only) were verified against
the spec text.

Author: mcpherrinm